Re: [qubes-users] Why should I verify digests, if I already checked PGP signatures?

2016-10-01 Thread Andrew David Wong
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 2016-10-01 09:36, Chris Laprise wrote:
> On 10/01/2016 09:07 AM, Arqwer wrote:
>> Documentation says to check digests after I verified an .iso with gpg. Why? 
>> Doesn't correct PGP signature mean, that .iso is good and came from Qubes 
>> developers?
>>
> 
> Its really an alternative to gpg verification, not an additional step. The 
> doc doesn't mention that.
> 
> Chris
> 

Added. Thanks!

- -- 
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJX8BHhAAoJENtN07w5UDAwo4wP/0xpjBLtFepW8Q4dNgESFQTM
ysz/60uomSlrUFkLkR+4c1r9kDIZx3HyGTGLBoHpBk3+Vdz34nwdcLNkj24GX39q
6cEk6jSpaYbWQPIU70jhWaQZfoVbAX2zgL7H1/Ga1VH6zWmQCY+KVCI0LBNWl9vq
jJsJfmuMsMBX5brWckvPGQA+KrNSElhEbIJ08hmhPkTKAq1GKe5+moMK2+pbSYqv
N1EthH4D9q/43dpsY2pPheNKHOQ7x3Tk/RnuiijbyUvIDrnigbC770lXjPZpPXWU
Vep9YSidTT0wFSgKKI56s1zzKRkrxkYnI3NKpfr4itTI+Bf6B+viQtEZ+zpE7lrG
Qo8zF+pTkdU6DoxQbpV8ywSPfjMnMKRktXiVUWUuA6vwWSqPxwXXPCJ4pb9yAx/y
eaYxqKfZ4jrPIfFzVF3QS3hHWIqHeJ/MmJFNoSiZSDIMgb5GF1au/QBWWUZ/Q6L2
+Fm5OJdjHwZaQJXf0WEU/1TcNUO8IWbsF4EZ5iF4tV0jzLeFCaPFh/aW1xPL/meY
I6az7OfhUxQ3ny0yxfC5LlgEsxFJP8gfP1emePkF10lVEXutJ9TPjRlI2Lqshh03
49YkkevusVONCsq/kDnOs26boI5zLL4TAkyhGyAUbHaivaXbpeVd0L5F6q2MczDj
gLXXxIWhqCzCAYyT9ox6
=4BEZ
-END PGP SIGNATURE-


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/db3bb367-2b8d-3bff-bf3b-9ed7709e4176%40qubes-os.org.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Why should I verify digests, if I already checked PGP signatures?

2016-10-01 Thread Chris Laprise

On 10/01/2016 09:07 AM, Arqwer wrote:

Documentation says to check digests after I verified an .iso with gpg. Why? 
Doesn't correct PGP signature mean, that .iso is good and came from Qubes 
developers?



Its really an alternative to gpg verification, not an additional step. 
The doc doesn't mention that.


Chris

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c5c544c4-d32c-5096-0327-d17ec7730b27%40openmailbox.org.
For more options, visit https://groups.google.com/d/optout.